Secure distributed information system for public device authentication

Abstract

A method of performing user authentication includes by a service electronic device associated with a service, receiving, from a public electronic device, a request for a user to initiate a session of the service, generating a first security token, a first write token, a first read token, and/or a first delete token, sending the first security token, the first write token, the first read token, and/or the first delete token to a server electronic device, receiving, from the server electronic device, a key location identifier that uniquely identifies a memory location of a data store associated with the server electronic device where the first security token, the first write token, the first read token, and/or the first delete token are stored, saving the key location identifier in a data store associated with the service electronic device, generating a signed key location identifier, generating a machine-readable image that includes the key location identifier, the signed key location identifier and the first write token in an encoded format, and sending the machine-readable image to the public electronic device.

What is claimed is: 
     
       1. A method of performing user authentication, the method comprising:
 by a service electronic device associated with a service:
 receiving, from a public electronic device, a request for a user to initiate a session of the service, 
 generating a first write token 
 sending the first write token to a server electronic device, 
 receiving, from the server electronic device, a key location identifier that uniquely identifies a memory location of a data store associated with the server electronic device where the first write token is stored, 
 saving the key location identifier in a data store associated with the service electronic device, 
 generating a signed key location identifier, 
 generating a machine-readable image that includes the key location identifier, the signed key location identifier and the first write token in an encoded format, and sending the machine-readable image to the public electronic device. 
 
 
     
     
       2. The method of  claim 1 , further comprising:
 by the public electronic device:
 receiving the machine-readable image, and 
 causing the machine-readable image to be displayed on a display device of the public electronic device, 
 
 by a user electronic device:
 scanning the machine-readable image to extract the key location identifier, the signed key location identifier and the first write token, 
 verifying that the signed key location identifier is valid for a public key associated with the service, 
 combining a public key associated with the user and the first write token to generate a combination value, 
 signing the combination value to generate a signed combination value, 
 encrypting the signed combination value to generate an encrypted signed combination value, and 
 sending the encrypted signed combination value, a first security token, a first read token, and a second key location identifier to the server electronic device, wherein the first security token and the first read token are generated by the electronic device and correspond to the user, wherein the second key location identifier uniquely identifies a second memory location of a data store associated with the server electronic device, wherein the first memory location and the second memory location are not the same. 
 
 
     
     
       3. The method of  claim 2 , wherein signing the combination value to generate a signed combination value comprises using a private key associated with the user to sign the combination value. 
     
     
       4. The method of  2 , wherein encrypting the signed combination value to generate an encrypted signed combination value comprises encrypting the signed combination value using a public key associated with the service. 
     
     
       5. The method of  claim 2 , further comprising: by the server electronic device: verifying that the first security token corresponds to information stored at the second memory location, in response to verifying that the first security token corresponds to information stored at the second memory location, saving the first read token and the encrypted signed combination value to the second memory location. 
     
     
       6. The method of  claim 5 , further comprising:
 by the server electronic device:
 receiving the first key location identifier, the first write token and the encrypted signed combination value from the user electronic device, 
 verifying that the first write token corresponds to information saved at the first memory location, and 
 in response to verifying that the first write token corresponds to information saved at the first memory location, saving the encrypted signed combination value to the first memory location. 
 
 
     
     
       7. The method of  claim 6 , further comprising:
 by the server electronic device:
 receiving the first key location identifier and a second read token from the service electronic device, 
 verify that a second read token corresponds to information stored at the first memory location, and 
 in response to verifying that a second read token corresponds to information stored at the first memory location, sending the encrypted signed combination value to the service electronic device. 
 
 
     
     
       8. The method of  claim 7 , further comprising:
 by the service electronic device:
 obtaining a first decrypted combination value by decrypting the encrypted signed combination value using the private key associated with the service; 
 extracting the public key associated with the user from the first decrypted combination value; 
 using the public key to locate an account associated with the user; and 
 sending the second key location identifier and the first read token to the server electronic device. 
 
 
     
     
       9. The method of  claim 8 , further comprising:
 by the server electronic device:
 verifying that the first read token corresponds to information stored at the second memory location, and 
 in response to verifying that the first read token corresponds to information stored at the second memory location, sending the encrypted signed combination value to the service electronic device. 
 
 
     
     
       10. The method of  claim 9 , further comprising:
 by the service electronic device:
 obtaining a second decrypted combination value by decrypting the encrypted signed combination value received from the server electronic device using the private key associated with the service, 
 comparing the second decrypted combination value to the first decrypted combination value to determine if they match, and 
 in response to the second decrypted combination value matching the first decrypted combination value, authenticating the session. 
 
 
     
     
       11. The method of  claim 10 , further comprising:
 by the server electronic device:
 receiving the first key location identifier and a first delete token from the service electronic device, 
 verifying that the first delete token corresponds to information stored at the first memory location, and 
 in response to verifying that the first delete token corresponds to information stored at the first memory location, deleting all information stored at the first memory location. 
 
 
     
     
       12. A system for performing user authentication, the system comprising:
 a service electronic device associated with a service; and 
 a computer-readable storage medium comprising one or more programming instructions that, when executed, cause the service electronic device to:
 receive, from a public electronic device, a request for a user to initiate a session of the service, 
 generate a first write token, 
 send the first write token to a server electronic device, 
 receive, from the server electronic device, a key location identifier that uniquely identifies a memory location of a data store associated with the server electronic device where the first write token is stored, 
 save the key location identifier in a data store associated with the service electronic device, 
 generate a signed key location identifier, 
 generate a machine-readable image that includes the key location identifier, the signed key location identifier and the first write token in an encoded format, and 
 send the machine-readable image to the public electronic device. 
 
 
     
     
       13. The system of  claim 12 , further comprising:
 a second computer-readable storage medium comprising one or more programming instructions that, when executed, cause the public electronic device to:
 receive the machine-readable image, and 
 cause the machine-readable image to be displayed on a display device of the public electronic device, 
 
 a third computer-readable storage medium comprising one or more programming instructions that, when executed, cause a user electronic device:
 scan the machine-readable image to extract the key location identifier, the signed key location identifier and the first write token, 
 verify that the signed key location identifier is valid for a public key associated with the service, 
 combine a public key associated with the user and the first write token to generate a combination value, 
 sign the combination value to generate a signed combination value, 
 encrypt the signed combination value to generate an encrypted signed combination value, and 
 send the encrypted signed combination value, a first security token, a first read token, and a second key location identifier to the server electronic device, wherein the first security token and the first read token are generated by the electronic device and correspond to the user, wherein the second key location identifier uniquely identifies a second memory location of a data store associated with the server electronic device, wherein the first memory location and the second memory location are not the same. 
 
 
     
     
       14. The system of  claim 13 , wherein the one or more programming instructions that, when executed, cause the user electronic device to sign the combination value to generate a signed combination value comprise one or more programming instructions that, when executed, cause the user electronic device to use a private key associated with the user to sign the combination value. 
     
     
       15. The system of  13 , wherein the one or more programming instructions that, when executed, cause the user electronic device to encrypt the signed combination value to generate an encrypted signed combination value comprise one or more programming instructions that, when executed, cause the user electronic device to encrypt the signed combination value using a public key associated with the service. 
     
     
       16. The system of  claim 13 , further comprising a fourth computer-readable storage medium comprising one or more programming instructions that, when executed, cause the server electronic device to:
 verify that the first security token corresponds to information stored at the second memory location, and 
 in response to verifying that the first security token corresponds to information stored at the second memory location, save the first token and the encrypted signed combination value to the second memory location. 
 
     
     
       17. The system of  claim 16 , wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
 receive the first key location identifier, the first write token and the encrypted signed combination value from the user electronic device, 
 verify that the first write token corresponds to information saved at the first memory location, and 
 in response to verifying that the first write token corresponds to information saved at the first memory location, save the encrypted signed combination value to the first memory location. 
 
     
     
       18. The system of  claim 17 , wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
 receive the first key location identifier and a second read token from the service electronic device, 
 verify that the second read token corresponds to information stored at the first memory location, and 
 in response to verifying that the second read token corresponds to information stored at the first memory location, sending the encrypted signed combination value to the service electronic device. 
 
     
     
       19. The system of  claim 18 , wherein the computer-readable storage medium further comprises one or more programming instructions that, then executed, cause the service electronic device to:
 obtain a first decrypted combination value by decrypting the encrypted signed combination value using the private key associated with the service; 
 extract the public key associated with the user from the first decrypted combination value; 
 use the public key to locate an account associated with the user; and 
 send the second key location identifier and the first read token to the server electronic device. 
 
     
     
       20. The system of  claim 19 , wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
 verify that the first read token corresponds to information stored at the second memory location, and 
 in response to verifying that the first read token corresponds to information stored at the second memory location, sending the encrypted signed combination value to the service electronic device. 
 
     
     
       21. The system of  claim 20 , wherein the computer-readable storage medium further comprises one or more programming instructions that, then executed, cause the service electronic device to:
 obtain a second decrypted combination value by decrypting the encrypted signed combination value received from the server electronic device using the private key associated with the service, 
 compare the second decrypted combination value to the first decrypted combination value to determine if they match, and 
 in response to the second decrypted combination value matching the first decrypted combination value, authenticate the session. 
 
     
     
       22. The system of  claim 21 , wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
 receive the first key location identifier and a first delete token from the service electronic device, 
 verify that the first delete token corresponds to information stored at the first memory location, and 
 
       in response to verifying that the first delete token corresponds to information stored at the first memory location, deleting all information stored at the first memory location.